VMware Spring Boot 2.7.x < 2.7.22, 3.0.x < 3.0.17, 3.1.x < 3.1.13, 3.2.x < 3.2.9, 3.3.x < 3.3.3 Signature Forgery Vulnerability - Linux

# SPDX-FileCopyrightText: 2024 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:vmware:spring_boot";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.153171");
  script_version("2025-09-04T05:39:49+0000");
  script_tag(name:"last_modification", value:"2025-09-04 05:39:49 +0000 (Thu, 04 Sep 2025)");
  script_tag(name:"creation_date", value:"2024-09-24 03:42:29 +0000 (Tue, 24 Sep 2024)");
  script_tag(name:"cvss_base", value:"5.5");
  script_tag(name:"cvss_base_vector", value:"AV:L/AC:H/Au:S/C:C/I:C/A:N");

  script_cve_id("CVE-2024-38807");

  script_tag(name:"qod_type", value:"executable_version_unreliable");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("VMware Spring Boot 2.7.x < 2.7.22, 3.0.x < 3.0.17, 3.1.x < 3.1.13, 3.2.x < 3.2.9, 3.3.x < 3.3.3 Signature Forgery Vulnerability - Linux");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2024 Greenbone AG");
  script_family("General");
  script_dependencies("gb_vmware_spring_boot_consolidation.nasl");
  script_mandatory_keys("vmware/spring/boot/ssh-login/detected");

  script_tag(name:"summary", value:"VMware Spring Boot is prone to a signature forgery
  vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"Applications that use spring-boot-loader or
  spring-boot-loader-classic and contain custom code that performs signature verification of nested
  jar files may be vulnerable to signature forgery where content that appears to have been signed
  by one signer has, in fact, been signed by another.");

  script_tag(name:"affected", value:"VMware Spring Boot versions 2.7.0 through 2.7.21, 3.0.0
  through 3.0.16, 3.1.0 through 3.1.12, 3.2.0 through 3.2.8 and 3.3.0 through 3.3.2.");

  script_tag(name:"solution", value:"Update to version 2.7.22, 3.0.17, 3.1.13, 3.2.9, 3.3.3 or
  later.");

  script_xref(name:"URL", value:"https://spring.io/security/cve-2024-38807");
  script_xref(name:"URL", value:"https://spring.io/blog/2024/08/23/spring-boot-releases-fix-for-cve-2024-38807");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit( 0 );

version = infos["version"];
location = infos["location"];

if (version_in_range_exclusive(version: version, test_version_lo: "2.7.0", test_version_up: "2.7.22")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "2.7.22", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "3.0.0", test_version_up: "3.0.17")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.0.17", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "3.1.0", test_version_up: "3.1.13")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.1.13", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "3.2.0", test_version_up: "3.2.9")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.2.9", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "3.3.0", test_version_up: "3.3.3")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.3.3", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);